Dashboards & Visualizations

Why does ColorPalette conditional shows in edit mode but not show in preview?

Bizzaro_Shake
Explorer

Below is a colorpalette expression I have in my classic dashboard:

<format type="color" field="Present">
<colorPalette type="expression">
if(value &gt; $90PercentThreshold$, "#f50d0d", "#43e40a") <green and red, respectively>
</colorPalette>
</format>

My query is:

"<sourceString>"
"Checking <directory>*"
| rex field=_raw "InputObject\";\s+value=\"Checking (?&lt;Directory&gt;[^\"]+) Max allowed:\s+(?&lt;Max_Allowed&gt;\d+).*Files present:\s+(?&lt;Present&gt;\d+)"
| dedup Directory
| eval 50PercentThreshold = Max_Allowed * 0.5
| eval 90PercentThreshold = Max_Allowed * 0.9
| table _time, Directory, Present, Max_Allowed
| sort - Present

This is getting a file count across several directories as well as the maximum allowed files in that directory (all within the log)\. My issue is that I can see the cells in the table colored during edit mode, but when I switch to preview, the colors are not present any longer (no color exists).

Additionally, is there a way to express multiple conditionals for the colorpalette? An example would be the following, but I must have the wrong syntax:


<format type="color" field="Present">
<colorPalette type="expression">
if(value &gt; $90PercentThreshold$, "#f50d0d",
if(value &gt; $50PercentThreshold$ AND value &lt; $90PercentThreshold$, "#f2bb11", "#43e40a"))
</colorPalette>
</format>

Thanks in advance!

 

Labels (2)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...